overkill

Overkill Overkill is an exploit for a patched vulnerability affecting QNAP QTS. Due to the way QNAP discloses vulnerabilities, I'm unsure if this issue has a CVE or not. However, it was likely patched in November 2020 and April 2021. The n-day was "discovered" while doing diff analysis for...

libxml2-exploit

libxml2-exploit An example exploit for CVE-2017-7376 Install Download this repo and a vulnerable version of libxml2, e.g. v2.7.7: root@kitploit: git clone https://github.com/brahmstaedt/libxml2-exploit.git cd libxml2-exploit wget https://github.com/GNOME/libxml2/archive/v2.7.7.zip unzip v2.7.7.zi...

ruby-nmap

ruby-nmap Source Issues Documentation Description A Ruby API to nmap, the exploration tool and security / port scanner. Allows automating nmap and parsing nmap XML files. Features Provides a Ruby API for automating nmap. Provides a Parser for enumerating nmap XML scan files. Supports the full Nma...

CVE-2024-34102

CVE-2024-34102 Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML...

CVE-2016-3141

CVE-2016-3141 1. Vulnerability Detail. Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service memory corruption and application crash or possibly have unspecified other impact by triggering a...

x-stream__xstream_CVE-2020-26217_1-4-14-java77

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the...

CVE-2017-9805

CVE-2017-9805: Apache Struts 2 S2-052 RCE Analizi Bu depo, Apache Struts 2 S2-052 üzerindeki XStream deserialization zafiyetine yönelik teknik detayları ve PoC Proof of Concept çalışmasını içermektedir. 📌 Zafiyet Bilgileri CVE Kodu: CVE-2017-9805 Zafiyet Türü: Uzaktan Kod Çalıştırma RCE Risk...

liblapith

Liblapith - Nessus 결과 파일을 파싱하기 위한 라이브러리 NCC Group Plc가 오픈소스로 공개 - http://www.nccgroup.com/ Felix Ingram이 개발, felix dot ingram at nccgroup dot com http://www.github.com/nccgroup/liblaptith LGPL로 공개됨. 자세한 내용은 LICENSE 참조 예제 root@kitploit: import liblapith scan = liblapith.load"" scan =...

MAL-006

MAL-006: WSO2 ESB の「Try It」における XML 外部エンティティ WSO2 ESB の「Try It」ツールにおいて、エラーベースの XML 外部エンティティ（XXE）攻撃が特定されました。 なぜCVEがないのか？ ベンダーは「Try It は本番環境では無効にすることが推奨されます」と回答し、公開開示は行われませんでした。 要件: この脆弱性には以下が必要です： 有効なユーザー資格情報 または 正規のWSO2リポジトリからXMLファイルを変更する または 「Try It」ツールに送信されるファイルを傍受および変更する 概念実証: 詳細と悪用プロセスは、この PD...

CVE-2025-7766

CVE-2025-7766 PoC Exploit PoC for exploiting XML External Entity vulnerability in CVE-2025-7766. Demonstrates file read /etc/passwd and out-of-band HTTP callbacks. Author : Byte Reaper CVE : CVE-2025-7766 Vulnerability : Remote Code Execution via XML External Entity XXE PoC for exploiting XXE in...

apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack

A flaw was found in Apache Portable Runtime Utility apr-util. A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the aprxmlquoteelem function. This could lead to a denial of service DoS due to an application cra...

ktor-xxe-poc

ktor-xxe-poc This is a proof-of-concept reproducing the security problem CVE-2023-45612. Versions Used Ktor: 2.2.3 xmlutil: 0.84.3 Java: 17.0.6 Gradle: 9.1.0 Python: 3.13.7 How to Run 1. Build and run the server: root@kitploit: ./gradlew build ./gradlew run 2. Test the XXE payload : root@kitploit...

CVE-2026-20224---XXE-Injection-en-Cisco-Catalyst-SD-WAN-Manager

CVE-2026-20224 - Cisco Catalyst SD-WAN Manager XXE Injection ⚠️ DISCLAIMER THIS TOOL IS EXCLUSIVELY FOR EDUCATIONAL AND RESEARCH PURPOSES This exploit is intended exclusively for authorized red team operations, penetration testing, and security research on systems where you have explicit written...

CVE-2020-4463

IBM Maximo Asset Management is vulnerable to Information Disclosure via XXE Vulnerability CVE-2020-4463 IBM Maximo Asset Management is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...

Linux Distros Unpatched Vulnerability : CVE-2026-19614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3. CVE-2026-19614 Not...

expat_2_1_0_CVE-2024-28757

Expat, Release 2.1.0 This is Expat, a C library for parsing XML, written by James Clark. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in the...

EUVD-2026-69236

xmldom: Quadratic-memory consumption...

EUVD-2026-65227

NLTK: Entity-expansion DoS billion laughs via remaining raw ElementTree parses...

EUVD-2026-64337

NLTK: Stable FrameNet and NKJP readers parse outside-root XML...

expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow

A flaw was found in libexpat, a library used for parsing XML data. An attacker could exploit a heap-based buffer overflow, a type of memory error, by providing specially crafted XML input. This vulnerability occurs when the library mishandles memory reallocation while processing XML, particularly...